FEDRKRAL BUREAU OF INVESTIGATION 
FOI/PA 
DELETED PAGE INFORMATION SHERT 
FOI/PA# 1353814-0 


Total Deleted Page(s) = 126 
Page 1 ~ Referral/Consult; 
Page 3 ~ Referral/Consult; 
Page 4 ~ Referral/Consult; 
Page 5 ~ Referral/Consult; 
Page 6 ~ Referral/Consult; 
Page 7 ~ Referral/Consult; 
Page 8 ~ Referral/Consult; 
Page 9 ~ Referral/Consult; 
Page 10 ~ Referral/Consult; 
Page 11 ~ Referral/Consult; 
Page 12 ~ Referral/Consult; 
Page 13 ~ Referral/Consult; 
Page 14 ~ Referral/Consult; 
Page 15 ~ Referral/Consult; 
Page 16 ~ Referral/Consult; 
Page 17 ~ Referral/Consult; 
Page 18 ~ Referral/Consult; 
Page 19 ~ Referral/Consult; 


Page 20 ~ Referral/Consult; 
Page 21 ~ Referral/Consult; 
Page 22 ~ Referral/Consult; 
Page 23 ~ Referral/Consult; 
Page 24 ~ Referral/Consult; 
Page 25 ~ Referral/Consult; 
Page 26 ~ Referral/Consult; 
Page 27 ~ Referral/Consult; 
Page 28 ~ Referral/Consult; 
Page 29 ~ Referral/Consult; 
Page 30 ~ Referral/Consult; 
Page 31 ~ Referral/Consult; 
Page 32 ~ Referral/Consult; 
Page 33 ~ Referral/Consult; 


Page 34 ~ Referral/Consult; 
Page 35 ~ Referral/Consult; 
Page 36 ~ Referral/Consult; 
Page 37 ~ Referral/Consult; 
Page 38 ~ Referral/Consult; 
Page 39 ~ Referral/Consult; 
Page 40 ~ Referral/Consult; 
Page 41 ~ Referral/Consult; 
Page 42 ~ Referral/Consult; 
Page 43 ~ Referral/Consult; 
Page 44 ~ Referral/Consult; 
Page 45 ~ Referral/Consult; 
Page 46 ~ Referral/Consult; 
Page 47 ~ Referral/Consult; 
Page 48 ~ Referral/Consult; 
Page 49 ~ Referral/Consult; 


Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 


50 Referral/Consult; 
Bak Referral/Consult; 
52 Referral/Consult; 
5S Referral/Consult; 
54 Referral/Consult; 
55 Referral/Consult; 
56 Referral/Consult; 
57 Referral/Consult; 
58 Referral/Consult; 
59 Referral/Consult; 
60 Referral/Consult; 
61 Referral/Consult; 
62 Referral/Consult; 
63 Referral/Consult; 
64 Referral/Consult; 
65 Referral/Consult; 
66 Referral/Consult; 
67 Referral/Consult; 
68 Referral/Consult; 
69 Referral/Consult; 
70 Referral/Consult; 
71 Referral/Consult; 
72 Referral/Consult; 
73 Referral/Consult; 
74 Referral/Consult; 
75 Referral/Consult; 
76 Referral/Consult; 
77 Referral/Consult; 
78 Referral/Consult; 
79 Referral/Consult; 
80 Referral/Consult; 
81 Referral/Consult; 
82 Referral/Consult; 
83 Referral/Consult; 
84 Referral/Consult; 
85 Referral/Consult; 
86 Referral/Consult; 
87 Referral/Consult; 
88 Referral/Consult; 
89 Referral/Consult; 
90 Referral/Consult; 
91 Referral/Consult; 
92 Referral/Consult; 
93 Referral/Consult; 
94 Referral/Consult; 
95 Referral/Consult; 
96 Referral/Consult; 
97 Referral/Consult; 
98 Referral/Consult; 
99 Referral/Consult; 
100 ~ Referral/Consult; 
101 ~ Referral/Consult; 
102 ~ Referral/Consult; 
103 ~ Referral/Consult; 


Pag 04 Referral/Consult; 
Page 105 Referral/Consult; 
Page 106 Referral/Consult; 
Page 107 Referral/Consult; 
Page 108 Referral/Consult; 
Page 109 Referral/Consult; 
Page 110 Referral/Consult; 
Page 111 Referral/Consult; 
Page 112 Referral/Consult; 
Page 113 Referral/Consult; 
Page 114 Referral/Consult; 
Page 115 Referral/Consult; 
Page 116 Referral/Consult; 
Page 117 Referral/Consult; 
Page 118 Referral/Consult; 
Page 119 Referral/Consult; 
Page 120 Referral/Consult; 
Page 121 Referral/Consult; 
Page 122 Referral/Consult; 
Page 123 Referral/Consult; 
Page 124 Referral/Consult; 
Page 125 Referral/Consult; 
Page 126 Referral/Consult; 
Page 127 Referral/Consult; 


XXXXKXKKKX KA KK AR KRKXKKK KARR 


Xx Deleted Page(s) x 
Xx No Duplication Fee X 
Xx For this Page Xx 


XXXKXKXXKKKX KA RK AR KK KKK KKK 


FEDKRAL BUREAU OF INVESTIGATION 
FOI/PA 
DELETED PAGE INFORMATION SHEET 
FOI/PA# 1353814-0 


Total Deleted Page(s) = 59 

Page 5 ~ b6; b7C; b7E; 

Page 6 ~ b6; b7C; b7E; 

Page 7 ~ Referral/Consult; 

Page 8 ~ Referral/Consult; 

Page 9 ~ Referral/Consult; 

Page 10 ~ Referral/Consult; 
Page 11 ~ Referral/Consult; 
Page 12 ~ Referral/Consult; 
Page 13 ~ Referral/Consult; 
Page 14 ~ Referral/Consult; 
Page 15 ~ Referral/Consult; 
Page 16 ~ Referral/Consult; 
Page 17 ~ Referral/Consult; 
Page 18 ~ Referral/Consult; 
Page 19 ~ Referral/Consult; 
Page 20 ~ Referral/Consult; 
Page 21 ~ Referral/Consult; 
Page 22 ~ Referral/Consult; 
Page 23 ~ Referral/Consult; 
Page 24 ~ Referral/Consult; 
Page 25 ~ Referral/Consult; 
Page 26 ~ Referral/Consult; 
Page 27 ~ Referral/Consult; 
Page 28 ~ Referral/Consult; 
Page 29 ~ Referral/Consult; 
Page 30 ~ Referral/Consult; 
Page 31 ~ Referral/Consult; 
Page 32 ~ Referral/Consult; 
Page 33 ~ Referral/Consult; 
Page 34 ~ Referral/Consult; 
Page 35 ~ Referral/Consult; 
Page 36 ~ Referral/Consult; 
Page 37 ~ Referral/Consult; 
Page 38 ~ Referral/Consult; 
Page 39 ~ Referral/Consult; 
Page 40 ~ Referral/Consult; 
Page 41 ~ Referral/Consult; 
Page 42 ~ Referral/Consult; 
Page 43 ~ Referral/Consult; 
Page 44 ~ Referral/Consult; 
Page 45 ~ Referral/Consult; 
Page 46 ~ Referral/Consult; 
Page 47 ~ Referral/Consult; 
Page 48 ~ Referral/Consult; 
Page 49 ~ Referral/Consult; 
Page 50 ~ Referral/Consult; 
Page 51 ~ Referral/Consult; 
Page 52 ~ Referral/Consult; 


Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 
Page 


53 Referral/Cons 
54 Referral/Cons 
55 Referral/Cons 
56 Referral/Cons 
57 Referral/Cons 
58 Referral/Cons 
59 Referral/Cons 
60 Referral/Cons 
61 Referral/Cons 
62 Referral/Cons 
63 Referral/Cons 


XXXXKXXKXXKXKXXK XX KK XKXXK XXX 


4 Deleted Page(s) x 
Xx No Duplication Fee X 
Xx For this Page Xx 


XXXKXKXXKKXKX KA KK AR KRAKXRKXAKRAX KKK 


ALL INEURRATICN CONTAINED 
HEREIN [5 UNCLASSIFIED 
DATE 12-13-2016 By J767leTso RelCG 


| XU 


FD-340 (Rev. 4-11-03 


: b3 
Peesped . BIE 
File-Number : 


Ficld Office Acquiring Evidence Eon <0 0 eee | 
Serial # of Originating Document Peer): ee ee 


Date Received fYloela ce 
| b7C 
From ie 


(Address) : 
(City and State) : b6 


b7C 
By 
To Be Retumed Yes EY No 
Receipt Given [] Yes [No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 
[) Yes EET No 
Federal Taxpayer Information (FTI) 
C] Yes J No 
i 
I 
Reference: 
(Communication Enclosing Material) : 
sree 
Description: 0 Original notes re interview of b6 
b7C 
b7E 


ra a | HRC-7691 


Bul INFORMATION CUD TAINED 
HEREIN [5 UNCLASSIFIED 
DAC 12-13-2016 By g/6cleTso AslcG 


b6 
b7c 
b7E 

From: 

Sent: 2015 5:53 PM 

To: 

Subject: 

Attachments: 

Please confirm successful receipt; | will provide password over phone. 
b6 
b7c 

b7E 


HRC- 7692 


ALL TMSURMATION CONTAINED 
RESEIN [6 UNCLASSIFIED 


DATE 10-19-2017 BY JS?)gsbTs4 NSIC . a 


sa, Egan ts Sem ees ros cin tah 


ALT 


FD-340 (Rev. 4-11 : 
Ficld Office Acquiring Evidence _ LO FO 


Serial # of Originating Document 3 b 


Date Received 


lof Contributor/Interviewee) | 


(Address) ' 


(City and State) 


To Be Retumed [] Yes AY. No 


Receipt Given 0) Yes No 
Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 


CO Yes Ja No 
Federal Taxpayer Information (FTI) 
OO Yes No 


MID EAT EXAM 


Reference: 
(Communication Enclosing Material) 


_ Description: C] Original notes re interview of . 


ces ’ OA we \ 


ABUL 


HRC-7752 


b3 


_DTE 


b7C 


b7E 


ALL [N2CRMATION CONTAINED 
BEBE IN 1S UN_LLASS u 
URTE le-lo-2016 Bl g/esleTet NSiCe 


U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


December 1, 2015 DIE 


Re: Request for Preservation of Records 


Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legal process. The FBI has previously sent 
preservation requests to your organization related to the below accounts on August 18, 2015 and July 
27, 2015. 


b6 


b7c . 


b7E ° 
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You are hereby requested to preserve the records described below currently in your 


possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


You are also requested not to disclose the existence of this request to the subscriber or any 


other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. [f compliance with this request may result 
in a permanent or temporary termination of service to the accounts described below, or otherwise 
alert the subscriber or user of these accounts as to your actions to preserve the referenced files 
and records, please contact Special A acer  eeoaeeray as soon as 


possible and before taking any such actions. 


This preservation request applies to the following records and evidence: 


A. The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the 
source and destination email address or IP address. 

B. All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and 


C. All connection logs and records of user activity for the requested account, including: 
1. Connection date and time; 
2. Disconnect date and time; 
3. Method of connection (e.g., telnet, ftp, http); 
4. Data transfer volume; 
5. User name associated with the connection and other connection information, including 
the Internet Protocol address of the source of the connection; 
6. Telephone caller identification records; and 
a Connection information for other computers to which the user of the above-referenced 
accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. 
8. Means and source of payment for such service (including any credit card or bank account 
number) and billing records. 
D. Any other records and other evidence relating to the requested account. Such records and other 
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b6 


“b7C | 


evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 
relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you have any questions regarding this request, ple i inaniri ial Agent 
[ho can be reached a rN Hate : 


Peter P. Strzok 
Assistant Special Agengin Charge 
Washington Field Office 
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Sent: 2015 4:19 PM 
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Subject: : reservation Request 


----- Original Message----- b6 

From b7C 
Sen er O1, bTE 
To: (WF) (FBI) 


Subject: Re: 


This is an automated response. Thank you for contacting ™—“SS™~™OCCCC”C”CiCS b7E 


eee aes is exclusively for submission of criminal law 
enforcement requests from an agency in the U.S. If you are not pursuing a criminal case on 
j please refer to 
regan how to serve[ __Jwith legal 
process and disregar e remainder i is communication. 


Preservation Request 


receives a government request for information spore | it is bE 
policy to notify the user before information is disclosed, unless such notice is 
prohibited by law. Prior to notifying the user, we will take steps to preserve the 


information you requested and are entitled to in accordance with the type of legal process 
submitted. 


b7E 
If you have not sent your request from an official government-issued email address or if you 
are not a law enforcement agent submitting a request pursuant to a criminal investigation, 
you may not receive a reply. 
incerel 
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From: 
Sent: 
To: 

Ce: 
Subject: 


Follow Up Flag: _ Follow up 
Flag Status: Flagged 


This is automated response to advise you thal as successfully received _ led 


your legal request submission. 


UPDATE: Submissions to this form will no longer be accepted as of January 1, 2016. 


bT7E- 


receives a very high volume of legal process every day. The team processes legal requests in the order sa 


that we receive them. If your request relates to exigent circumstances or if you have further questions, please 
an referencing the Case number in the subject line of this email. Please 
include a description of the exigency or your question(s) in detail so that we may assess your request 
accordingly. 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


December 2, 2015 
b7E 


Re: Request for Preservation of Records 
Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for 
the preservation of all stored communications, records and other evidence in your possession 
regarding the following e-mail accounts, pending further legal process. . 


You are hereby requested to preserve the records described below currently in your. 
possession, including records stored on backup media, in a form that includes the complete 
_ record, and records that may come into your possession from the date of acknowledgment of this 
request for a period of 90 days, or until receipt of a legal court order, whichever occurs first. 


This request applies only retrospectively. It does not in any way obligate you to capture and 
preserve new information that arises after the date of this request. 


You are also requested not to disclose the existence of this request to the subscriber or 
any other person, other than as necessary to comply with this request, as the FBI's investigation 
may be jeopardized by this type of disclosure. You are also requested not to close the account of 
the subscriber, unless requested to do so by the subscriber. If compliance with this request may 
result in a permanent or temporary termination of service to the accounts described below, or 
otherwise alert the subscriber or user of these accounts as to = actions to preserve the 


referenced files and records, please contact Special Agent at [ b6 
as soon as possible and before taking any such actions. Bae 


This preservation request applies to the following records and evidence: 


_HRC-7759 


The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files; such as the 
source and destination email address or IP address. 


All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, 
without limitation, subscriber names, user names, screen names or other identities, 
mailing addresses, residential addresses, business addresses, e-mail addresses and 
other contact information, telephone numbers or other subscriber number or _ 
identity, billing records, information about the length of service and the types of 

_ services the subscriber or customer utilized, and any other identifying ~ 
information, whether such records or other evidence are in electronic or other 
form; and ; 

All connection logs and records of user activity for the requested account, 

including: 


Connection date and time; 

Disconnect date and time; 

Method of connection (e.g., telnet, ftp, http); 

Data transfer volume; 

User name associated with the connection and other connection 
information, including the Internet Protocol address of the source of the 
connection; 

Telephone caller identification records; and 

Connection information for other computers to which the user of the 
above-referenced accounts connected, by any means, during the 
connection period, including the destination IP address, connection time 
and date, disconnect time and date, method of connection to the 
destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such 
connection information relates, and all other information related to the 
connection from ISP or its subsidiaries. 

8. Means and source of payment for such service (including any credit card 
or bank account number) and billing records. 


Sa a a 


he ok 


Any other records and other evidence relating to the requested account. Such _ 
records and other evidence include, without limitation, correspondence and other 
records of contact by any person or entity about the above-referenced account, the 
content and connection logs associated with or relating to postings, 
communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 
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If you have a: uestions regarding this request, please direct all inquiries to 
i ho can be reached ? eaaaeeress © an 


é Washington | Field ai 
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WF) (FBI 
From: Lowe) FB) 
Sent: Tuesday, December 01, 2015 4:19 PM 
To: (WF) (FBI) 
Subject: _ Preservation Request 
Attachments: [—presencion Extension. pdf 


From{ KW) (FBI) 


Sent: Tuesday, December 01, 2015 4:13 PM 
To ] 


‘Subject: Preservation Request 


Please see the attached request to preserve records at your organization. 


Thanks, 


a 


Intelligence Analyst 
FBI, Washington Field Office 
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~ ATIN: Custodian of Records Recipient Telephone #: me 
. Number of Pages Including Coversheet: 3 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


December 2, 201 5 


Re: Request for Preservation of Records 
Dear Custodian of Records: 


t 
Pursuant to Title 18, United States Code Section 2703(6), this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legal process. 


[| 


You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 


and records that may come into your possession from the date of acknowledgment of this request for 


a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


You are also requested not to disclose the existence ‘of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. [f compliance with this request may result 

in a permanent or temporary termination of service to the| accounts described below, or otherwise 
alert the subscriber or user of these acco arc to preserve the referenced files 
and records, please contact Special = ce ae as soon as possible 
and before taking any such actions. 

This preservation request applies to the following nee and evidence: 


A. The contents of any communication or for the accounts any associated accounts, 
_and any information associated with those communications or files, such as the 
source and destination email address or IP address. 
B. All records and other evidence relating to the subscriber(s), customer(s), account 


HRC-7765 


b7E 


b6 
b7C 


H 


~ holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and 


C. All connection logs and records of user activity for the requested account, including: 
i Connection date and time; 
De Disconnect date and time; 2 2 
3. Method of connection (e.g., telnet, ftp, rey , 
4. Data transfer volume; 
5: User name associated with the connection and other connection information, including 


ceeoh 


D. Any other records and other evidence relating to the requested account. Such records and other. 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 
relating to postings, communications and any other activities to or through the requested account, 


the Internet Protocol address of the source of the connection; 

Telephone caller identification records; and 

Connection information for other computers to which the user of the above- vefeneiced 
accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 


information relates, and all other information related to the connection from ISP or its © 


subsidiaries. 


Means and source of payment for such service (including any credit card or bank account 


number) and billing records. 


whether such records or other evidence are in electronic or other form. 


If = have any questions a this ae please direct all a to = (a Agent 


ho can be reached a 


Washington Field Office 
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_ U.S. Department of Justice 


_ Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


December 4, 2015 


Gregory B. Starr 

Assistant Secretary, Bureau of Diplomatic Security 
U.S. Department of State 

2201 C Street, NW 

Washington, D.C. 20520 


Re: Request for Production of ClassNet and JWICS Email Records 


Dear Assistant Secretary Starr: 


This request supplements previous request sent to the U.S. Department of State (DoS) 
relative to the preservation and production of records associated with @clintonemail.com. 


In furtherance of our examination of this matter, the FBI respectfully requests the 
production of all ClassNet and JWICS email messages sent to, or from, the following individuals 
for the period of January 21, 2009 to February 1, 2013: 


In the event that any of the above referenced individuals did not have a ClassNet or 
JWICS email account during the referenced time period, or that-such records cannot be produced 
for technical or other means, it is requested that your response details such. It is further 
requested that these records be provided to the FBI within thirty (30) days from the receipt of 
this request. 


You are requested not to disclose the existence of this request to individuals other than to 
those necessary to comply with this request, as the FBI's interest in this matter may otherwise be 
jeopardized. 


HRC-7768 


b7E ° 


Agen 


uestions regarding thi 
who can be reached ai 


irect all inquiries to Special 
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Assistant Spéeial Agent in Charge 
Washington | Field Office 
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DATE 12-20-2016 BX G7YGGLETED NEIL: 


From: 
Sent: 
To: 
Cc: 
Subject: roduction reques 
Attachments: DOS _production_request_04Dec15.pdf 


: 


Per our phone call, please find the email production request attached. 


b7Cc 
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We understand that some of the identified individuals may not have email accounts on the specified systems. In such 


instances we just request that this is documented in the response from DoS. 
Please let me know if you have any questions about this request. 


v/r 


| | 
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From: ; 

Sent: Thursday, December 17, 2015 7:52 AM 
To: 

Cc: (WF) (FBI) 

Subject: Re: Preservation and production requests 


Thanks [__] Received.[ | 


Sent martphone. 
From: 


Sent:_Wednesday, December 16, 2015 4:5@ PM 

To: 

ce: (wr) (e81);[ 
on requests 


Subject: Preservation and producti 


b6 
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b7c 


Attached are two separate requests for the preservation and production of relevant records. 


Please confirm receipt of this email. 


Thank you for your help and don’t hesitate to call if you have any questions or concerns. 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


December 17, 2015 


b7E 


Re: Request for Preservation of Records 
Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the 


reservation of all stored communications, records and other evidence in your possession regarding 
a pencing farther legal process bs 


You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


; You are also requested not to disclose the existence of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. If compliance with this request may result — 
in a permanent or temporary termination of service to the accounts described below, or otherwise 
alert the subscriber or user of these accounts as to your actions ta, erenced files 
and records, please contact Special aed | ae le soon as sae 


possible and before taking any such actions. 
This preservation request applies to the following records and evidence: 


A. The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the 
source and destination email address or IP address. 

B. All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without 


HRC-/824 


limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and 


Ci All connection logs and records of user activity for the requested account, including: 
1. Connection date and time; 
2 Disconnect date and time; 
3. Method of connection (e.g., telnet, ftp, http); 
4. Data transfer volume; 
> User name associated with the connection and other connection information, including 
the Internet Protocol address of the source of the connection; 

6. Telephone caller identification records; and 

7. Connection information for other computers to which the user of the above-referenced 


accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. . 

8. Means and source of payment for such service (including any credit card or bank account 
number) and billing records. 


D. Any other records and other evidence relating to the requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 
relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you have any questions regarding this request, please direct all inquiries to Special Agent 
Do rhocan bereached a orf be 


Assistant Special Agent in Charge 
Washington Field Office 
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Sent: 2015 10:47 AM bE 
To: 
Subject: reservation Requs 


Attachments: [_|Preservation_Letter_201 5_12_17_10_39_ 50_191.pdf 


Custodian of Records, 

Pursuant to Title 18, US Code Section 2703(f), please see the attached letter/formal request for the preservation or all 

stored communications, records and other evidence in your possession regarding the highlighted b7E 
Thanks in advance for your assistance with this matter. 


Respectfully, 


b7C 


Special Agent 


i al Field Office 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


January 11, 2016 


Gregory B. Starr 

Assistant Secretary, Bureau of Diplomatic Security 
_ U.S. Department of State 

2201 C Street, NW 

Washington, D.C. 20520 


Re: Request for the Production of Secure and Unsecure Facsimiles sent to the 
Secretary of State on June 17, 2011. ; 


Dear Assistant Secretary Starr: 


This request supplements previous requests sent to the U.S. Department of State relative 
- to the preservation and production of records associated with @clintonemail.com. 


In furtherance of our examination of this matter, the FBI respectfully requests the 
production of any documents that were transmitted to. the Secretary of State on Friday, June 17, 
2011 via secure and unsecure facsimile. This request includes relevant facsimile logs for the 
referenced date, as well as any available content. These records should be provided to the FBI 
within thirty (30) days from the receipt of this request. 


You are requested not to disclose the existence of this request to individuals other than to 
those necessary to comply with this request, as the FBI's interest in this matter may otherwise be 


jeopardized. If you have any questions regarding this request, please direct all inquiries to 
Special (aa Oo can be reached a 


hy 


Washington Field Office 
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U.S. Department of Justice | 
Federal Bureau of Investigation. 
Washinton D.C. 20535- 0001 


~ January 14, 2016 


Gregory B, Starr =. = - 

Assistant Secretary, Bureau of Diplomatic SEC 
U.S. Department of State 

2201 C Street, NW 

Masnineo D.C. 20520 


Re: . Reduce for the production sp Huma Abedin’s s personal email as provided to 
DoS as part of the FOIA process. ; ey 


Dear Assistant Sera Starr: 


. This request sipplements previous requests sent to ‘the US. Desatnes of State ielatve | 
— to the preservation and production of records pssociated with @clintonemail. com. 


In furtherance of our examination of this matter, the FBI respectfully: requests the 
. production. of all of Huma Abedin’s personal emails that were provided to DoS as part’ of the © 
FOIA process. : The emails should be provided in an un-redacted format and. should not. be . 
limited to just those that directly include the former Secretary of State, as pertinent conversations © 
may not have directly included the Secretary. These records should bé es to the FBI | 
within thirty ae, days from the receipt. of this ee oo 


You are requested not to disclose the existence of this request to individuals aiher than to 
-those necessary to comply with this request, as the FBI's interest in this matter may otherwise be 


_ jeopardized. If you have any questions regarding this re rect allinquiriesto” = e - 
Special a can be reached at ar b7C 


Assistant Special Agent in Charge 
ia ae Field Office . 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


February 16, 2016 b7E 


Re: Extending Request for Preservation of Records 


Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request to 
extend the preservation of all stored communications, records and other evidence in your possession 
regarding the attached e-mail accounts, pending further legal process. 


You are hereby requested to extend the preservation of the records described in the attached 
communication, which was sent to your company on 24 November 2015, currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


If you have any questions regarding this request, please dir inauiri Special: Agent{ | BS 
“ | / ys 


Peter P. Strzok ( _) 
Assistant Special Agent in Charge 
Washington Field Office 
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Washington, D.C. 20535-0001 


February 16, 2016 b7E 


Re: Preservation of Records 
Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request to 
extend the preservation of all stored communications, records and other evidence in your possession 
regarding the attached e-mail accounts, pending further legal process. 


You are hereby requested to extend the preservation of the records described in the attached 
communication, which was sent to your company on 24 November 2015, currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


b6 
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[who can bereached al of | 


Peter P. Strzog 4 N 
Assistant SpeciafAgent in Charge 
Washington Field Office 
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February 16, 2016 b7E 


Re: Preservation of Records 
Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request to 
extend the preservation of all stored communications, records and other evidence in your possession 
regarding the attached e-mail accounts, pending further legal process. 


You are hereby requested to extend the preservation of the records described in the attached 
communication, which was sent to your company on 24 November 2015, currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


If you have any questions regarding this request, please direct all inquiries to Special Agent | i _ 


Assistant Special Agent in Charge 
Washington Field Office 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


February 16, 2016 bIE 


Re: Preservation of Records 
Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request to 
extend the preservation of all stored communications, records and other evidence in your possession 
regarding the attached e-mail accounts, pending further legal process. 


You are hereby requested to extend the preservation of the records described in the attached 
communication, which was sent to your company on 24 November 2015, currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to vapture and preserve new 
information that arises after the date of this request. 


If you have any questions regarding this request, please direct all inquiries to Special Agel | oe 


Peter P. Strza 


Te 


Assistant Specia A ‘gent in Charge 
Washington Field Office 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


February 16, 2016 b7E 


Re: Preservation of Records 
Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703 (f), this letter is a formal request to 
extend the preservation ofall stored communications, records and other evidence in your possession 
regarding the attached e-mail accounts, pending further legal process. 


You are hereby requested to extend the preservation of the records described in the attached 
communication, which was sent to your company on 24 November 2015, currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way, obligate you to capture and preserve new 
information that arises after the date of this request. 


If you have any questions regarding this request, please direct all inguiri Special Agen{ b6 
b7C 


who can be reached at 0) 


Peter P. Strzok~ 
Assistant Special Agent in Charge 


Washington Field Office 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


February 16, 2016 b7E 


Re: Preservation of Records 
Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request to 
extend the preservation of all stored communications, records and other evidence in your possession 
regarding the attached e-mail accounts, pending further legal process. 


You are hereby requested to extend the preservation of the records described in the attached 
communication, which was sent to your company on 24 November 2015, currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


ou have any questions regarding this request, please direct all inquiries to Special Agenf b6 
ho canbe reached ae ue 
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Washington, D.C. 20535-0001 


February 16, 2016 b7E 


Re: Preservation of Records 


Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request to 
extend the preservation of all stored communications, records and other evidence in your possession 
regarding the attached e-mail accounts, pending further legal process. 


You are hereby requested to extend the preservation of the records described in the attached 
communication, which was sent to your company on 24 November 2015, currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


If you have any questio j is request, | j inquiri Special Agen{ | Be 
[who can be reached a . b7C 


\\ 


Peter P. StrzoR 
Assistant Special Agent in Charge 
Washington Field Office 
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U.S. Department of Justice 


_Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


February 16, 2016 b7E 


Re: Preservation of Records 


Deaf | . b7E 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request to 
extend the preservation of all stored communications, records and other evidence in your possession 
regarding the attached e-mail accounts, pending further legal process. 


You are hereby requested to extend the preservation of the records described in the attached 
communication, which was sent to your company on 24 November 2015, currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


February 16, 2016 poe 


Re: Preservation of Records 
Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request to 
extend the preservation of all stored communications, records and other evidence in your possession 
regarding the attached e-mail accounts, pending further legal process. 


You are hereby requested to extend the preservation of the records described in the attached 
communication, which was sent to your company on 24 November 2015, currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 
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From: 

Sent: b6 
To: b7c 
Ce: (OGC) (FBI) b7E 
Subject: RE Preservation Request 


[ [Thank you, I'll pass this on. Best{ | 


Per the email discussion below we are submitting a preservation extension request for 19 accounts as detailed inthe 
attached pdf file. 


lam currently having some difficulty o submit the request sd Once | 
amabletoL__—_] will submit the reques ut in the meantime | wanted to send you the 1 ¢ 


request. b7C 


/ b7E 
Please let me of know if you have any questions or concerns regarding this request. 
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v/r 
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SA 
FBI — Washington Field Office 


Fromi__Koc) (FB) bé 


Sent: : M b7c 
To WF) (FBI) bTE 
Subject: FW: Preservation Request 


Sorry for the delay. Here’s the correspondence from the last request. 


Fromi|________|(OGC) (FB!) | (Be 


reservation Request 


Thanks| _| Let me know if there are any names missing from the list below. . 


1 
HRC-8013 


mber 01, 2015 9:01 AM b7C 
F) (FBI) b7E 


From bé 

H ember 30, 2015 8:44 PM b7Cc 
(OGC) (FBI) b7E 
Subject: RE: Preservation Request 


Hope all’s welll __ recently received the attached preservation extension request for the original 422 
accounts. Per your email of 10/9 below, we understood the FBI had limited its request to 16 accounts identified in the 
original 8/18 request, and 3 identified in a separate 7/27 request, for a total of 19. I’m told the FBI hasn’t sent in a 
separate extension for the 7/27 request. 


For'the sake of clarity would it be possible for the FBI to send us a preservation request on letterhead that just identifies 
the 19 accounts below? That way we can aiso ensure all 19 are on the same preservation schedule. Please let me know 
if you have any questions or would like to discuss. Best 


b6 
: b7C 
b7E 
\ 
1 ata! 
Sent: Monday, October 19, 2015 1:36 PM 
To QGC) (FBI) 
Subject: RE: Preservation Request 
b6 


noticed that 3 of the accounts identified below were not listed in the August 18th preservation request, but bic 
were listed in the attached request from July 27th. Those 3 accounts are: 


HRC-8014 


If you need to extend either preservation request, | b6 


would suggest the FBI send in one extension request for the July 27th request, and a separate extension request for the b7c 
narrowed August 18th request. That will ly eliminate confusion as to what’s being preserved and for how long. b7E 
Fee! free to call with any questions. Best, 


From: 


Sent: Fri er 09, 2015 9:56 AM , 
To; OGC) (FBI) 
Subject: RE Preservation Request 
b6 


[| Thanks very much. I'll pass this on | Best[ | . ne 


From 

oe = = 7 =< 7:58 AM 
To: 

Subject Preservation Request | 


In response to your September 14, 2015 letter and per our follow up discussions, the FBI has narrowed the scope of its 
August 18, 2015 preservation request to the following accounts: 


b6 
b7C 
b7E 


HRC-8015 


At this time, in accordance with 18 U.S.C. 2703(f}, we request that you continue to preserve the accounts listed above in 
accordance with terms of the original request dated August 18, 2015 (attached). We are no longer seeking preservation 
of the other accounts in that request. Finally, we note that the Court’s order, pursuant to 18 U.S.C. 2705(b), issued on 
August 28, 2015 remains in place, and we request that you not notify the account holders on this list. 


Please let me know if you have any questions. 


Sincerely, 


| : “2 
; b7Cc 
Assistant General Counsel 
National Security Law Branch 


Office of the General Counsel 


(eas | Investigation 


Confidentiality Statement: 

This message is transmitted to you by the Office of the General Counsel of the Federal Bureau of Investigation. The message, along 

with any attachments, may be confidential and legally privileged. If you are not the intended recipient of this message, please 

destroy it promptly without further retention or dissemination (unless otherwise required by law). Please notify the sender of the 

error by a separate e-mail or by calling b6 . 
b7C 


NOTICE: This communication may contain privileged or other confidential information. If you have received it in error, please advise the sender by reply email and 
immediately delete the message and any attachments without copying or disclosing the contents. Thank you. 


A A NN 


NOTICE: This communication may contain privileged or other confidential information. If you have received it in error, please advise the sender by hae email and 
immediately delete the message and any attachments without copying or disclosing the contents. Thank you. 
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DATE 12-21-2016 BY gieclsTso Ssice 


U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


February 16, 2016 


bT7E 


Re: Preservation of Records 
Dear Custodian of Records: 


' Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request to 
extend the preservation of all stored communications, records and other evidence in your possession 
regarding the attached e-mail accounts, pending further legal process. 


You are hereby requested to extend the preservation of the records described in the attached 
communication, which was sent to your company on 24 November 2015, currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


2015 by the United States District Court for the Eastern District of Virginia commanding ot b7E 
to notify any person, including the subscribers or customers of the accounts listed in the attache 
preservation letter, of the existence of said preservation letter for a period of two years. 


If you have any question equest, please’ direct all inquiries to Special sen] 
c 


Pursuant to Title 18, United States Code Section 2705(b), an Order was issued on 28 - 


Se 5 fe, bbeee PRS fis gee - Cae ules Washington Field Office | 
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b6 


' b7C 


b7E 


ALL [INPORRATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 12-21-2016 BY G7GGlLeTSO NEICG 


: Monday, February 22, 2016 3:55 PM poe 
To: 
Subject: 


This is an automated response to advise you that; as b7E 


successfully received your legal request submission. 


receives a very high volume of legal process every day. The team processes legal bTE 


—— in the order that_we receive them. You may monitor the status of your request by 
If yo r_request relates to exigent circumstances or if you have further questions, please 
emai and include tel reterene: number listed in the _ BIE 


subject line. Please include a description of the exigency or your question(s) so that we may 
assess your request accordingly. 


Regards 


HRC-8027/ 


SLL INSUGRMATION CONTAINED 
te ~- : HEREIN [5 UNCLASSIFIED 
. DATE 12-21-2016 AY 376018780 SILC 


U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


February 22, 2016 


b7E 


Re: Request for Preservation of Records 


Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legal process. 


{ 


b7E 


_ You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 
applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


You are also requested not to disclose the existence of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. If compliance with this request may result 
in a permanent or temporary termination of service to the accounts described below, or otherwise 
alert the subscriber or user of these accounts as to your actions to preserve the referenced files 
and records, please contact Special 7 caematammre  ccmacas F soon as aun 


possible and before taking any such actions. 


This preservation request applies to the following records and evidence: 


HRC-8028 


A. The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the 


source 


and destination email address or IP address. 


B. All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 


addres 


ses, residential addresses, business addresses, e-mail addresses and other . 


contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and 


C. All connection logs and records of user activity for the requested account, including: 
1. Connection date and time; 
2 Disconnect date and time; 
3. Method of connection (e.g., telnet, ftp, http); 
4. Data transfer volume; 
a User name associated with the connection and other connection information, including 


the Internet Protocol address of the source of the connection; 

Telephone caller identification records; and . 

Connection information for other computers to which the user of the above-referenced 
accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. 

Means and source of payment for such service Siena any credit card or bank account 
number) and billing records. 


D. Any other records and other evidence relating to the requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 


relatin 


g to postings, communications and any other activities to or through the peUesie account, 


whether such records or other evidence are in electronic or other form. 


If you have any questions regarding this request, please direct all inquiries to Special Agent 
[Pro can be reached a —) 


peers F ield Office 


HRC-8029 
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'b3 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


Re: 


ALL INEORMATION CONTAINED 
HEREIHW IS JN CLASSIFIED 
DATE 12-21-2016 Bx J/S2leTSs0 HSICG 


February 23, 2016 


Request for Preservation of Records 


Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legal process. 


[ 


You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete record, 
and records that may come into your possession from the date of acknowledgment of this request for 
a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 


applies only retrospectively. It does not in any way obligate you to capture and preserve new 
information that arises after the date of this request. 


You are also requested not to disclose the existence of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. If compliance with this request may result 
in a permanent or temporary termination of service to the accounts described below, or otherwise. 
alert the subscriber or user of these accounts as to yo ions to preserve renced files 
and records, please contact Special A gent] dat as soon as 


possible and before taking any such actions. 


This preservation request applies to the following records and evidence: 


A. 


The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the 
source and destination email address or IP address. 


_ HRC-8032 


bTE 


b7E 


b7E 


b6 
b7Cc 


B. All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and 


C. All connection logs and records of user activity for the requested account, including: 
1, Connection date and time; 
2. Disconnect date and time; 
a Method of connection (e.g., telnet, ftp, http); 
4, Data transfer volume; 
5. User name associated with the connection and other connection information, including 
the Internet Protocol address of the source of the connection; 
6. Telephone caller identification records; and 
de Connection information for other computers to which the user of the above- referenced 


accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. 

8. Means and source of payment for such service (including any credit card or bank account 
number) and billing records. 


D. Any other records and other evidence relating to the requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 
relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you have any jiestions seg np escent this request, please direct alli gent ee 


Assistant Special Agent in Charge 
Washington Field Office 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


February 23, 2016 


b7E 


Re: Request for Preservation of Records 


Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the 
preservation of all stored communications, records and other evidence in your possession regarding 
the following e-mail accounts, pending further legal process. 


[| = 

; b7C 
b7E 
You are hereby requested to preserve the records described below currently in your 

possession, including records stored on backup media, in a form that includes the complete record, 

and records that may come into your possession from the date of acknowledgment of this request for 

a period of 90 days, or until receipt of a legal court order, whichever occurs first. This request 

applies only retrospectively. It does not in any way obligate you to capture and preserve new 

information that arises after the date of this request. 


You are also requested not to disclose the existence of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. [f compliance with this request may result 
in a permanent or temporary termination of service to the accounts described below, or otherwise 
alert the subscriber or user of these accounts _as to your actions to preserve the referenced files 
and records, please contact Special oS en ame soon as ee 
possible and before taking any such actions. 
This preservation request applies to the following records and evidence: 
A. The contents of any communication or for the accounts any associated accounts, 


and any information associated with those communications or files, such as the 
source and destination email address or IP address. 


HRC-8039 


bw 


If you have any sitiestioné regarding this request 
[rt can be reached ee 


B. All records and other evidence relating to the subscriber(s), customer(s), account 


holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and . 


C. All connection logs and records of user activity for the requested account, including: 
1. Connection date and time; 
2: Disconnect date and time; 
3, Method of connection (e.g., telnet, ftp, http); 
4. Data transfer volume; 
o: User name associated with the connection and other connection information, including 


the Internet Protocol address of the source of the connection; 

6. Telephone caller identification records; and 

7, Connection information for other computers to which the user of the above-referenced 
accounts connected, by any means, during the connection period, including the 
destination IP address, connection time and date, disconnect time and date, method of 
connection to the destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such connection 
information relates, and all other information related to the connection from ISP or its 
subsidiaries. 

8. Means and source of payment for such service (including any credit card or bank account 
number) and billing records. 


D. Any other records and other evidence relating to the requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 
relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. . 


b6 
b7C 


Agent in Charge 


Washington Field Office 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


March 2, 2016 
b7E 


Re: Request for Preservation of Records 


Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for 
the preservation of all stored communications, records and other evidence in your possession 


regarding the following ———————S—S———_jaccount, pending further legal process. 

You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete 
record, and records that may come into your possession from the date of acknowledgment of this 
request for a period-of 90 days, or until receipt of a legal court order, whichever occurs first. 


This request applies only retrospectively. It does not in any way obligate you to capture and 
preserve new information that arises. after the date of this request. 


You are also requested not to disclose the existence of this request to the subscriber or 
any other person, other than as necessary to comply with this request, as the FBI's investigation 
may be jeopardized by this type of disclosure. You are also requested not to close the account of 
the subscriber, unless requested to do so by the subscriber. If compliance with this request may 
‘result in a permanent or temporary termination of service to the accounts described below, or 
otherwise alert the subscriber or user of these accounts a. serve the 
ae files and records, please contact Special 7 eames ee aa 
as soon as possible and before taking any such actions. 


This preservation request applies to the following records and evidence: 
A. The contents of any communication or for the accounts any associated accounts, ° 


and any information associated with those communications or files, such as the source and 
destination email address or IP address. 


HRC-8046 


B. All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without limitation, 
subscriber names, user names, screen names or other identities, mailing addresses, residential 
addresses, business addresses, e-mail addresses and other contact information, telephone 
numbers or other subscriber number or identity, billing records, information about the length of 
service and the types of services the subscriber or customer utilized, and any other identifying 
information, whether such records or other evidence are in electronic or other form; and 


Cc; All connection logs and records of user activity for the requested account, 
including: 

Le Connection date and time; 

2: Disconnect date and time; 

3. Method of connection (e. B-» rae ftp, http); 

4, Data transfer volume; 

Di User name associated with the connection and other connection 
information, including the Internet Protocol address of the source of the 
connection; 

6. Telephone caller identification records; and 

iD Connection information for other computers to which the user of the 


above-referenced accounts connected, by any means, during the 
connection period, including the destination IP address, connection time 
and date, disconnect time and date, method of connection to the 
destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such 
connection information relates, and all other information related to the 
connection from ISP or its subsidiaries. 

8. Means and source of payment for such service (including any credit card 

or bank account number) and billing records. 


D. Any other records and other evidence relating to the requested account. Such 
records and other evidence include, without limitation, correspondence and other records of 
contact by any person or entity about the above-referenced account, the content and connection 
logs associated with or relating to postings, communications and any other activities to or 


through the requested account, whether such records or other evidence are in electronic or other 
form. 


If you have any questions regarding this request, please direct all inquiries to 
ho can be reached amas 


Assistant Special Agent i in Charge 
Washington Field Office 


HRC-8047 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


March 3, 2016 oe 


Re: Request for Preservation of Records 


Dear Custodian of Records: 


Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for 
the preservation of all stored communications, records and other evidence in your possession 
regarding the following email account, pending further legal process. 

b6 
. 3 b7E 

You are hereby requested to preserve the records described below currently in your 
possession, including records stored on backup media, in a form that includes the complete 
record, and records that may come into your possession from the date of acknowledgment of this 
request for a period of 90 days, or until receipt of a legal court order, whichever occurs first. 


This request applies only retrospectively. It does not in any way obligate you to capture and 
preserve new information that arises after the date of this request. 


You are also requested not to disclose the existence of this request to the subscriber or 

any other person, other than as necessary to comply with this request, as the FBI's investigation 

may be jeopardized by this type of disclosure. You are also requested not to close the account of 

the subscriber, unless requested to do so by the subscriber. If compliance with this request may 

result in a permanent or temporary termination of service to the accounts described below, or 

otherwise alert the subscriber or user of these accounts as to your actions to preserve the 

referenced files and records, please contact Special A oO peereeees afi b6 

as soon as possible and before taking any such actions. me 

This preservation request applies to the following records and evidence: 


A. The contents of any communication or for the accounts any associated accounts, 
and any information associated with those communications or files, such as the source and 
destination email address or IP address. 


HRC-8048 


B. All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without limitation, 
subscriber names, user names, screen names or other identities, mailing addresses, residential 
addresses, business addresses, e-mail addresses and other contact information, telephone 
numbers or other subscriber number or identity, billing records, information about the length of 
service and the types of services the subscriber or customer utilized, and any other identifying 
information, whether such records or other evidence are in electronic or other form; and 


Cc All connection logs and records of user activity for the requested account, 
including: 
Ts Connection date and time; 
2; Disconnect date and time; 
me Method of connection (e.g., telnet, ftp, http); 
4, Data transfer volume; 
5. User name associated with the connection and sttige connection 


information, including the Internet Protocol address of the source of the 


connection; 
6. Telephone caller identification records; and 
fe Connection information for other computers to which the user of the 


above-referenced accounts connected, by any means, during the 
connection period, including the destination IP address, connection time 
and date, disconnect time and date, method of connection to the 
destination computer, the identities (account and screen names) and 
subscriber information, if known, for any person or entity to which such 
connection information relates, and all other information related to the 
connection from ISP or its subsidiaries. 

8. Means and source of payment for such service (including any credit card 
or bank account number) and billing records. 


D. Any other records and other evidence relating to the requested account. Such 
records and other evidence include, without limitation, correspondence and other records of 
contact by any person or entity about the above-referenced account, the content and connection 
logs associated with or relating to postings, communications and any other activities to or 
through the requested account, whether such records or other evidence are in electronic or other _ 
form. , 


If you have any questions regarding this request, please direct all inquiries to ~ _ 
ho can be reached af pe ue 


Peter P. Sti I 


Assistant Spetial Agent in Charge 
_ Washington Field Office 
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June 3, 2016 ie 


Re: Preservation of Records 
Dear Custodian of Records: 


_ Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request to 
extend the preservation of all stored communications, records and other evidence in your possession 
regarding the attached e-mail accounts, pending further legal process. 


b6 
b7E 
: You are hereby requested to extend the pr jon is record which was sent to your 
company on 22 February 20 ure in your possession, 
including records stored on backup media, in a form that includes the complete record, and records 


that may come into your possession from the date of acknowledgment of this request for a period of 
90 days, or until receipt of a legal court order, whichever occurs first. This request applies only 
retrospectively. It does not in any way obligate you to capture and preserve new information that 
arises after the date of this request. 


You are also requested not to disclose the existence of this request to the subscriber or any 
other person, other than as necessary to comply with this request, as the FBI's investigation may be 
jeopardized by this type of disclosure. You are also requested not to close the account of the 
subscriber, unless requested to do so by the subscriber. If compliance with this request may result 
in a permanent or temporary termination of service to the accounts described below, or otherwise 
alert the subscriber or user of these acco ions to preserve the referenced files pe 
and records, please contact Special A ) eae maaseena soon as b7C 
possible and before taking any such actions. 
This preservation request applies to the following records and evidence: 


A. The contents of any communication or for the accounts any associated accounts, _ 
and any information associated with those communications or files, such as the 


HRC-8114 


source and destination email address or IP address. 

B. All records and other evidence relating to the subscriber(s), customer(s), account 
holder(s), or other entity(ies) associated with the requested account including, without 
limitation, subscriber names, user names, screen names or other identities, mailing 
addresses, residential addresses, business addresses, e-mail addresses and other 
contact information, telephone numbers or other subscriber number or identity, billing 
records, information about the length of service and the types of services the 
subscriber or customer utilized, and any other identifying information, whether such 
records or other evidence are in electronic or other form; and © 


Cc. All connection logs and records of user activity for the requested account, including: 
i Connection date and time; 
2. Disconnect date and time; 
3. Method of connection (e.g., telnet, ftp, http); 
4, Data transfer volume; 
5: User name associated with the connection and other connection information, including 


the Internet Protocol address of the source of the connection; 

Telephone caller identification records; and 

Connection information for other computers to which the user of the above-referenced 

accounts connected, by any means, during the connection period, including the 

destination IP address, connection time and date, disconnect time and date, method of 

connection to the destination computer, the identities (account and screen names) and 

subscriber information, if known, for any person or entity to which such connection 

information relates, and all other information related to the connection from ISP or its 

subsidiaries. 

8. Means and source of payment for such service (including any credit card or bank account 
number) and billing records. 


NO 


D. Any other records and other evidence relating to the requested account. Such records and other 
evidence include, without limitation, correspondence and other records of contact by any person 
or entity about the above-referenced account, the content and connection logs associated with or 
relating to postings, communications and any other activities to or through the requested account, 
whether such records or other evidence are in electronic or other form. 


If you have any questions regarding this request, please direct all inquiries to Special Agent| | b6 


1 
Qs 4) g Y 2 
Petef P. Strzok 
Section Chief ‘ 
Counterintelligence Division 
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